Sophos Central MCP — Claude Code MCP server: what it does
Wires your agent into the Sophos Central partner, organization and tenant APIs and picks the right tenant and region on its own.
Open on GitHubWhat Sophos Central MCP does
The server exposes Sophos Central's APIs to an agent and routes each call to the correct tenant and region. On top of that it adds a triage queue spanning tenants, tamper cleanup across the fleet, a SIEM collector and hostname-based containment. It runs on your own machine and needs no code.
The installer puts two binaries in your user bin path: sophos-central-cli and sophos-central-mcp. Claude, Codex and Cowork pick up the skill from SKILL.md in that directory. Check the install with sophos-central-cli --version.
Do not start HTTP mode (--transport http), not even on localhost. This build validates a token, yet it has no cap on request size or response time. Stay on stdio, and tear down any tunnel you opened for a remote agent. The MCP tools also change settings using your credentials, so hand them the narrowest access you can.
What it helps with
- route Sophos Central calls to the right tenant and region
- pull incidents from every tenant into one triage queue
- clear tamper events across the machine fleet
- contain a host by hostname
- feed Sophos Central events into a SIEM
Example prompts for the agent
- Show me Sophos Central incidents across all tenants from the last day
- Contain host
WS-014in the client's tenant - Collect Sophos Central events into the SIEM
How to install Sophos Central MCP
Install
The MCP registry has no launch command for it: see the repository README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Sophos Central MCP
How do I install Sophos Central MCP in Claude Code?
Add the marketplace with /plugin marketplace add Servosity/msp-skills, then install the plugin: /plugin install sophos-central@msp-skills.
What does Sophos Central MCP do?
It gives an agent access to the Sophos Central partner, organization and tenant APIs and chooses the tenant and region itself. It also handles cross-tenant triage, tamper remediation, SIEM collection and hostname-based containment.
Why should HTTP mode stay off?
In this build it checks a token but sets no ceiling on request size or response time. Until the fix ships, use stdio and shut down any tunnel for a remote agent.
